1
70%
main: 70%

Ran 03 Aug 2026 03:21PM UTC

Files 867

Run time 41s

Badge

Embed ▾

Committed 03 Aug 2026 03:15PM UTC coverage: 69.924% (+0.06%) from 69.865%

Job # 30826608202.1

Build Type

push

github

Committed by

web-flow

Commit Message

Re-verify stored signatures offline during sync (#6131)

Sync now re-verifies each managed entry's stored Sigstore bundle
against the identity recorded in the lock file — entirely offline, via
the embedded trust root — before an entry can count as current
(RFC THV-0080). A failed re-verification is drift: check mode reports
it (the CI gate covers signatures like it covers content drift), and
apply mode reinstalls from the pinned reference, where install-time
verification enforces the locked identity and heals the stored state.
An OCI entry recording a signer identity without a stored bundle fails
closed; git entries store no bundle by design — their signatures are
re-verified when content is re-resolved.

Adoption back-fills provenance from the stored bundle when one exists;
otherwise adopting is the same trust decision as an unsigned install
and now requires the explicit --allow-unsigned exception (new flag on
sync, threaded through the API), recorded as unsigned in the entry.

Part of #5899.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

82838 of 118469 relevant lines covered (69.92%)

98.0 hits per line

stacklok / toolhive / 30826608202 / 1
70%
main: 70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 30826608202.1

stacklok / toolhive / 30826608202 / 1 70% main: 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 30826608202.1

stacklok / toolhive / 30826608202 / 1
70%
main: 70%

README BADGES
x